Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I manage a domain with the "Active Directory Users and Computers" from a computer that is not on that domain? I realize I'll need some domain admin (or less) credentials, but that's fine.

I have 2 scenarios where I'd like to do this:

  1. From a machine on Domain 1 but I'd also like to manage Domain 2 (the 2 domains are in no way related)
  2. From a laptop that is not a member of any domain.

If we can figure out #2, that will be "good enough" but #1 would be nice too.

share|improve this question
up vote 8 down vote accepted

The "poor man's domain trust relationship" seems to do it for me.

I'm having no problems using "Active Directory Users and Computers" to administer accounts in a domain untrusted by my laptop computer (which is, itself, not a member of any domain) by creating a local account with a username and password that matches a user that's a member of "Domain Admins" in the domain to be managed. I'm launching ADU&C with "Run As" and supplying the alternative credential.

That same method ought to work fine for your first scenario, as well. Try it and see.

(My laptop client is running Windows XP Professional SP3 and the test domain controller is running Windows Server 2003 Standard x86 R2 SP2).

share|improve this answer
I've heard of this referred to as "pass-through authentication". I've used it for similar purposes. – Holocryptic May 13 '10 at 16:50
I don't know what the "official" name for the functionality is, but I'm certainly glad that Microsoft bothered to continue "supporting" it in new versions of Windows. – Evan Anderson May 13 '10 at 16:54
+1 Works well for me as well. – Dave M May 13 '10 at 17:08
This works well for me. A bit inconvenient, but I'll get over it. ;-) Note that in Win7, you must hold [SHIFT] while you right-click to get "Run As Different User" instead of just getting "Run As Admin". – Jaxidian May 13 '10 at 17:20

It has been a while since I've had to do this, but I've had good luck mapping a drive to one of the DC's in my target domain using a Domain Admin user. Then launching ADU&C and attaching to the target domain. It inherits my domain credentials. Otherwise, Evan's method would be the 'seamless' method.

share|improve this answer
I'm not getting that to work w/ my test client and domain controller. I tried mapping drives to \\\sysvol and \\\c$ simultaneously (and individually) but I was still getting authentication errors when I actually tried to "Connect to Domain..." or "Connect to Domain Controller..." in ADU&C. – Evan Anderson May 13 '10 at 17:40
As I said, it has been a while since I tried it, and when I tried it I was using XP. And I'm not currently equipped to test it right now. So! Experimentation rules the day, and it would not surprise me in the least to learn that Vista/W7 don't allow that method to work. – sysadmin1138 May 13 '10 at 18:01
I bet it depends on how you connect to the domain controller. If you just connect by domain name (whatever magic that performs), then it would not work. However, if you connected to that specific domain controller (by specifying the hostname you used when mapping files), then I bet it would work. – Jaxidian May 13 '10 at 18:37

Use the Credential Manager / Vault (search for it in start) to add a Windows credential for the AD server. Be sure to specify the username as DOMAIN\User. This worked for me just now. [This thread was a top search result but did not have a working answer for me, so I posted despite it being many years old...]

share|improve this answer
I hope they already found the answer after 5 years. – Jeroen Sep 1 '15 at 15:11
@Jeroen, they're posting this answer not for the OP, but for anyone else that might stumble across this Q&A. – Gene Sep 1 '15 at 15:24

My laptop is joined to a DOMAIN1. I can perfectly manage DOMAIN2 with this command. I did not have to create any local account. DOMAIN1 and DOMAIN2 are completely different controllers. No trust relationship exists.

The command is:

runas /u:DOMAIN2\Administrator /netonly "mmc %windir%\system32\dsa.msc /server=DOMAIN2"

You will be prompted for Administrator password. Hope this helps.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.